Did Twitter Change Your Password?

Today, blogger Andrew Girdwood pointed out in his post that Twitter is forcing its users to change their passwords. According to Andrew, these users have received an email containing the following message: “Due to concern that your account may have been compromised in a phishing attack that took place off-Twitter, your password was reset,” together with a link for resetting the password.

Now although these emails looks suspicious, and after taking a look at these emails I would not blame them either, they are genuine. It seems that Twitter is trying to prevent any attacks from an undisclosed/unknown source.

The Next Web writes about unconfirmed reports from Twitter users that this might be in regard to a user account @THCx. A thread on Twitter’s support system recommends that users change their passwords immediately if they are currently following that specific Twitter account. @THCx, supposedly a tips/tutorials service, has managed to gain access to over 42000 user accounts in a matter of days and doesn’t appear to be following one.

The screenshot below shows that it’s possible, if @THCx is the culprit, that they may have gained access to users via NutshellMail, a service that lets you access and reply to Twitter messages as you would email. So if Twitter asks you to change your password, look at the link in the email, right click on it and click on copy link location (if you are using Firefox), then paste it on the Notepad. Then check the actual URL on the Notepad and see if it begins with http://twitter.com, if it does then it is a genuine email. In that case, go ahead and follow the instructions.